Do subdomains need their own DS records for DNSSEC?

My registrar does not support DNS Management without a hosting package. I wrote to the entity that manages the TLD and the records were added. But I would prefer not to write to them every time I add a subdomain to have DS records added.

SStulla My registrar does not support DNS Management without a hosting package. I wrote ...

DarkDeviL•6/27/24, 4:42 PM

Short answer: Yes.

Every sub-delegation (with NSNS records) means you have a new delegation to secure, and it require the DSDS record for the child zone, to be present in the parent zone.

In order for example.comexample.com (residing on Cloudflare) to point test.example.comtest.example.com to the name servers at e.g. Amazon Route 53, you will need to add both the NSNS records, as well as a DSDS record for test.example.comtest.example.com on the example example.comexample.com (through Cloudflare)

If you do not have that DSDS record (that is matching the DNSKEY stuff on the test.example.comtest.example.com zone on Amazon Route 53), then you would NOT have secured the path for the child delegation from example.comexample.com and down to test.example.comtest.example.com.

DarkDeviL•6/27/24, 4:46 PM

Re.

But I would prefer not to write to them every time I add a subdomain to have DS records added.

It is only the path from comcom to example.comexample.com, that you need to have secured through your domain registrar for example.comexample.com.

The DSDS record to secure sub-delegations, likeexample.comexample.com -> test.example.comtest.example.com will be done in your own example.comexample.com zone, on your current DNS service, and do NOT require your registrar's interference, assuming that DNSSEC is already configured through your registrar for example.comexample.com.

StullaOP•6/28/24, 4:39 PM

I am using Cloudflare for DNS. So far, I have two subdomains. One for a Cloudflare Pages site and the other for a Gitlab Pages site. I have read this document https://developers.cloudflare.com/dns/zone-setups/subdomain-setup/dnssec/ but I do not understand a thing because my DNSSEC records don't have an option to add other records in Cloudflare Dashboard

Cloudflare Docs

Enable DNSSEC - subdomain setup · Cloudflare DNS docs

As opposed to the normal process for enabling DNSSEC, DNSSEC with a subdomain setup requires a few additional steps.

SStulla I am using Cloudflare for DNS. So far, I have two subdomains. One for a Cloudfla...

DarkDeviL•6/28/24, 6:48 PM

That would normally be done with a couple of CNAMECNAME records.

DarkDeviL•6/28/24, 6:49 PM

There would be nothing additional to (re)configure in regards to DNSSEC for that kind of set up (with CNAMECNAME).

StullaOP•6/29/24, 10:39 PM

So, in short, after creating the subdomain as a cname, I don't need to do anything else? Because some subdomains will not be proxied, like the Gitlab one.

DarkDeviL•6/29/24, 10:42 PM

"Need" is sometimes such a big word.

DarkDeviL•6/29/24, 10:44 PM

If you add a CNAMECNAME from

www.example.com

www.example.com

to cname.test.examplecname.test.example, Cloudflare will automatically do what's needed to be done, in regards to

www.example.com

www.example.com

, under the condition that example.comexample.com is properly set up with DNSSEC.

DarkDeviL•6/29/24, 10:45 PM

DNSSEC's security will however, to some degree, be killed if the destination of the CNAMECNAME (e.g. cname.test.examplecname.test.example above) is not DNSSEC signed.

DarkDeviL•6/29/24, 10:46 PM

In order to avoid that, your vendor (e.g. the operator of cname.test.examplecname.test.example) would have to make sure their domain has DNSSEC too.

DarkDeviL•6/29/24, 10:53 PM

With Cloudflare, you can however try enabling the Proxy status (:cloudflare:) for the CNAMECNAME, as an attempt to mitigate that part.

However, the vendor will not be able to see that the CNAMECNAME exist with that configuration, - and with many vendors, it often give issues such as e.g.:

Their system does not detect that your (sub-)domain is configured to use their platform.
Their system won't generate any TLS certificates for your (sub-)domain.

StullaOP•7/1/24, 11:37 PM

Now I am beyond confused because I am not understanding your explanation on the relationship between example.comexample.com and cname.test.example.comcname.test.example.com. Is there a way to break this down in layperson's language?

My cnames are in the format of test.example.comtest.example.com. My question was whether I need to add any DNSSEC for these and if so, how? Coz I don't see that option in the dashboard.

two subdomains are Cloudflare pages sites (proxied) and the other points to gitlab pages (non-proxied). Cloudflare is the authoritative DNS host.

StullaOP•7/7/24, 10:43 AM

anyone?

SStulla Now I am beyond confused because I am not understanding your explanation on the ...

DarkDeviL•7/7/24, 1:32 PM

My cnames are in the format of test.example.comtest.example.com. My question was whether I need to add any DNSSEC for these and if so, how? Coz I don't see that option in the dashboard.

No, there will not be anything else you can do, from your end, than to configure the CNAME record.

Do subdomains need their own DS records for DNSSEC?

Similar Threads

Similar Threads

Similar Threads